WO2008022514A1 - Method, system and apparatus for user access authentication - Google Patents

Abstract

A method for user access authentication, a dynamic host configuration protocol (DHCP) server distributing IP addresses to the authorized users, includes: users getting encrypting information from the network; the users encrypting their passwords with the encrypting information, and then sending the encrypted passwords to the network; the network authenticating the users in accordance with the encrypting information and the prestoring passwords. A system and an apparatus for user access authentication are also provided in present invention. This application can make the sending of passwords safer, prevent the waste of IP addresses, and effectively avoid the attack of unauthorized users.

Description

 Method, system and device for user access authentication

 The present invention relates to network security authentication technologies, and in particular, to a method, system and device for user access authentication.

Background of the invention

 At present, the main access authentication technologies mainly have the following three types: Ethernet point-to-point protocol

(Point-to-Point Protocol over Ethernet, PPPoE), Dynamic Host Configuration Protocol (DHCP) + Web and ΙΕΕΕ802.1χ _ο These three authentication methods are briefly described below.

 (1) PPPoE

 PPPoE is similar to the traditional dial-up access method. It is an extension of the traditional public switched telephone network (PSTN) narrowband dial-up access technology in Ethernet access technology. It is consistent with the original narrowband network user access authentication system. . Since PPPoE encapsulates each IP packet in an Ethernet frame, once the number of users increases or the IP packet increases, the encapsulation speed must not keep up, which becomes a network bottleneck. Moreover, the PPPoE access mode is not conducive to the development of multicast services, and most of the video services are based on multicast. In addition, the PPPoE access method requires the operator to provide client terminal software, and the maintenance workload is too large.

 (2) DHCP+Web

DHCP+Web authentication requires a DHCP server to work with a web server. The user first obtains an IP address through the DHCP server and uses this IP address to communicate with the Web server. The Broadband Remote Access Server (BRAS) forces the user to connect to the Web server and pops up the authentication page in the browser. On this page, the user enters the account number and password; the BRAS receives the user's information, checks the legality of the user, and authenticates the user to the AAA server; after the authentication is passed, the user can obtain the user's A new legal IP address allows users to access the external Internet or specific network services.

 In this way, authentication and service flow are separated, and the value-added service can be easily launched by using the Web server to promote the service and guide the user. The DHCP + Web authentication method can realize more value-added services and can be well-off. Support for multicast services. However, in the DHCP + Web authentication mode, the IP address is allocated before the user authentication, which causes a waste of the IP address, and there is no unified standard for the DHCP+Web authentication method.

 (3) IEEE802.1X

 802. lx technology is a port-based authentication technology. The authentication phase uses the Extended Authentication Protocol (EAP) packet. The EAP packet is an extension of the PPP packet. The authentication phase is similar to the PPPoE mode. The authentication process is as follows: The user initiates authentication by using the EAP over LAN (EAPL) packet through the 802.1x client software. The switch terminates the EAPoL packet and forwards the EAP packet to the authentication server. After the authentication is passed, the DHCP server is configured. The user assigns an IP address, and the user controlled port is opened, allowing the user to communicate normally. Although the 802.1x authentication method solves the problems of PPPoE and DHCP + Web authentication methods, the 802. lx authentication method requires specific client software, and 802.1x does not currently have a standard client. Different vendors have different client programs, so the workload is maintained. In addition, because the 802.1x protocol is a Layer 2 protocol, it is only responsible for the authentication control of the user port. After the port authentication is completed, the user needs to continue to solve the user IP address allocation and the Layer 3 network after entering the Layer 3 IP network. Security and other issues, therefore, the Ethernet switch + 802.1X alone, can not fully solve the problems of the operational, manageable and access security of the Ethernet access of the metropolitan area network.

 In addition, the prior art also provides an authentication method for implementing user access through a DHCP protocol. The process is as follows:

(1) The client device generates a password based on the password and the session parameters (generated by the client device) Certificate ( certificate ).

 (2) The client device establishes a DHCP Discover message and sends it to the authentication device. The message includes the user identifier, the session parameter, and the certificate generated in step (1).

 (3) The authentication device generates a verification certificate based on the received session parameters and associated passwords.

 (4) Compare the received certificate with the certificate. If they are the same, the certificate is considered to have passed.

 In this method, the user equipment itself selects the session parameters used to generate the certificate, and this method cannot effectively prevent the retransmission attack. As long as the attacker intercepts the DHCP Discover message sent by the client and then resends it, the attacker can obtain the authorized address and access the network smoothly.

Summary of the invention

 Embodiments of the present invention provide a method, system, and apparatus for user access authentication to enhance the security of user authentication.

 The user access authentication method of the embodiment of the present invention, after the user end passes the authentication, uses the IP address allocated by the dynamic host configuration protocol DHCP server to access the network, including: the user end obtains the encrypted information from the network side;

 The user end encrypts the user password by using the encrypted information, and transmits the encrypted user password to the network side;

 The network side authenticates the client according to the encrypted information and a pre-stored user password.

 A user access authentication system includes:

 The network side device is configured to send a random number, and perform authentication on the user equipment according to the random number and the encryption algorithm, and after the authentication is passed, assign an IP address to the user equipment;

The user equipment adds the user password by using the random number delivered by the network side device. The encrypted user password is transmitted to the network side device, and after the authentication is passed, the IP address assigned by the network side is used to access the network.

 A network side device, including:

 Encrypting the information sending module, and sending, to the user end, the encrypted information used for access authentication of the user end;

 The address allocation module allocates an IP address to the client after the user end authenticates. The embodiment of the invention encrypts the user password by using the encrypted information generated by the network side, so that the password transmission is more secure; no special client software is needed, as long as the DHCP protocol is supported; and the user is assigned an IP address after the authentication, It avoids the waste of IP address; implements user authentication on the network layer to ensure the security of the three-layer network.

BRIEF DESCRIPTION OF THE DRAWINGS

 FIG. 1 is a schematic diagram of a process of user access authentication in an embodiment of the present invention.

 FIG. 2 is a schematic diagram of a process for implementing strong authentication according to an embodiment of the present invention.

Mode for carrying out the invention

 In order to make the technical solutions and advantages of the present invention more clear, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

 In order to solve the security problem when the user password is transmitted, the embodiment of the present invention obtains the encrypted information, such as a random number, a key or a certificate, from the network side when the user requests the IP address, and the user encrypts the user password by using the encrypted information, and The encrypted user password is transmitted to the network side, and the network side uses the above-mentioned encrypted information and a pre-stored user password to authenticate the user.

The user password is encrypted by using the encrypted information sent by the user on the network side. The same encryption information is used to authenticate the user on the network side. After the user authentication succeeds, the IP address assigned by the DHCP server on the network side can be used. The wave of the IP address Fees, and make password delivery more secure.

 The following describes an embodiment of the present invention by taking the encrypted information as a random number as an example. The random number can be generated by a Network Access Server (NAS), an Authentication Authorization Accounting Server (AAA Server), or a DHCP server on the network side and provided to the user through a DHCP server. The encryption algorithm used may be set in advance on the user side and the network side, that is, set to the same encryption algorithm, such as the HMAC-MD5 algorithm, or may be negotiated between the user end and the network side. The user access authentication process in the embodiment of the present invention is described in detail below.

 FIG. 1 is a schematic diagram of a user access authentication process according to an embodiment of the present invention. In this embodiment, a random number, such as a challenge word (Challenge Id), is generated by an AAA server, and an encryption algorithm is negotiated between a client and an AAA server. . The process of Layer 3 authentication through the DHCP protocol when the user equipment is started for the first time includes:

 Step 101: The client device, that is, the DHCP client, prompts the user to input a username and a password. For example, the user may be prompted to input a username and password by using a pop-up window or voice on the DHCP client.

 Step 102: The DHCP client sends a DHCP Discover message to the NAS, where the user identifier and the user's request for the encryption algorithm are carried. The user identifier is used to uniquely identify the user, and may be a username, a MAC address, or the like. The user's request for the encryption algorithm may be an encryption algorithm supported by the user. If the DHCP client does not need to negotiate an encryption algorithm with the AAA server, the DHCP Discover message does not need to carry the user's request for the encryption algorithm. The encryption algorithm requested by the user may be HMAC-MD5 or other algorithms (such as HMAC-SHA algorithm), or multiple encryption algorithms to be selected by the AAA server.

Step 103: After receiving the DHCP Discover message, the NAS first caches the DHCP Discover message, and then sends a Challenge Id request message to the AAA server, requesting one. Challenge Id, and negotiate encryption algorithm with AAA server. The Challenge Id request message includes a user's request for an encryption algorithm, that is, one or more encryption algorithms supported by the user that can be used to encrypt the user's password.

 Step 104: After receiving the Challenge Id request message, the AAA server allocates a Challenge Id to the user, establishes a binding relationship between the Challenge Id and the user, and simultaneously encrypts the user password supported by the user. One or more encryption algorithms select one of the user-available encryption algorithms (such as HMAC-MD5), and return a Challenge Id response message to the NAS, which includes the assigned Challenge Id and the selected encryption algorithm (HMAC-MD5).

 Step 105: After receiving the Challenge Id response message of the AAA server, the NAS obtains the assigned Challenge Id and the selected encryption algorithm from the Challenge Id response message, and uses the Challenge Id and the selected encryption algorithm as relay agent information options ( The Relay Agent Information Option is added to the cached DHCP Discover message and sent to the DHCP server.

 Step 106: After receiving the DHCP Discover message, the DHCP server selects an IP address in the address pool according to the user identifier (in IPv4, only one IP address is assigned, but in IPv6, it is not limited to one IP address), and The Relay Agent Information Option of the DHCP Discover message acquires the Challenge Id and the selected encryption algorithm, and then sends a DHCP Offer message to the NAS, the message including the selected IP address, Challenge Id, and the selected encryption algorithm.

 Step 107: The NAS forwards the DHCP Offer message to the DHCP client.

Step 108: After receiving the DHCP Offer message, the DHCP client obtains the Challenge Id and the selected encryption algorithm from the DHCP Offer message, and encrypts the user password by using the Challenge Id and the selected encryption algorithm, and sends a DHCP Request message to the NAS. , which carries the user ID, Challenge Id, and encrypted user password. Step 109: After receiving the DHCP Request message, the NAS first caches the DHCP Request message, and then obtains the user identifier, Challenge Id, and the encrypted user password from the DHCP Request message, and then sends an authentication request to the AAA server, where the authentication request carries User ID, Challenge Id, and encrypted user password.

 Step 110: After receiving the authentication request message, the AAA server searches for a user password corresponding to the user identifier in the database according to the user identifier. If a matching user password is found, the AAA server encrypts the found user password using the Challenge Id in the authentication request and the selected encryption algorithm; if the AAA server calculates the encrypted user password and the encryption carried in the authentication request message If the user password is the same, the authentication is passed, otherwise the authentication fails. If the authentication is successful, the AAA server sends an authentication success message to the NAS; otherwise, the process ends.

 Step 111: After receiving the authentication success message, the NAS forwards the cached DHCP Request message to the DHCP server.

 Step 112: After receiving the DHCP Request message, the DHCP server confirms the address allocation and parameter configuration, and returns a DHCP acknowledgement message (DHCP Ack) to the NAS, indicating that the user is allowed to use the allocated address.

 Step 113: The NAS forwards the DHCP Ack message to the DHCP client.

 Step 114: The DHCP client receives the DHCP Ack message and successfully accesses the network.

 In the above process, the negotiation of the encryption algorithm between the DHCP client and the AAA server is an optional process, and the encryption algorithm may be directly notified by the AAA server or one of the DHCP clients to the other party without negotiation. , but not limited to this.

For example, if the encryption algorithm used by the AAA server is directly notified by the DHCP client, the user-supported encryption algorithm or the selected encryption algorithm need not be carried in steps 102-107, and the Challenge Id and the user may be utilized in step 108. Pre-configured plus The secret algorithm encrypts the user password and notifies the AAA server of the adopted encryption algorithm through the DHCP Request message.

 In addition, in the embodiment of the present invention, the Challenge Id may be generated by the AAA server or by the NAS or the DHCP server.

 If generated by the NAS, steps 103 and 104 may be used only for negotiation of the encryption algorithm without having to request Challenge Id from the AAA server. In the step 105, the Challenge Id is allocated to the user by the NAS, and the binding relationship between the Challenge Id and the user is established, and the Challenge Id is carried in the DHCP Discover message and sent to the DHCP server. If the encryption algorithm negotiation is not required between the DHCP client and the AAA server, steps 103 and 104 can be omitted directly.

 If the Challenge Id is generated by the DHCP server, in the case of negotiating the encryption algorithm, the DHCP Offer message carries the Challenge Id generated by the DHCP server in step 106, and the Challenge Id does not need to be generated and carried in steps 101-105. If the encryption algorithm negotiation is not required between the DHCP client and the AAA server, steps 103 and 104 can be omitted directly. There are other forms as well.

 Through the above user access authentication process, the security problem when transmitting the password is solved. The user can only pass the authentication of the authentication server according to the Challenge Id that is returned by the DHCP server and bound by the user and encrypted by the encryption algorithm. After the authentication is passed, the user can actually assign the IP address. Therefore, even if the attacker intercepts the DHCP Discover message sent by the client, since the Challenge Id is allocated by the network side, the attacker cannot check the binding between the Challenge Id and the user, so it can effectively prevent the retransmission attack.

In addition, this embodiment may further include the following steps: Step 115: The user obtains a key (including a shared key or other key) or a certificate from the network side through a network (such as Web, FTP, or other means), and establishes the key (or certificate) and the user on the network side. Binding relationship, so that after the DHCP client restarts (for example, shutdown and restart), the three-layer authentication process can be performed through the key or certificate.

 Since encryption is used (such as HMAC-MD5 algorithm, but not limited to this), encryption is a weak authentication method, and users can directly configure (or other out-of-band methods) or extend the authentication protocol before the first startup. EAP and other methods obtain a certificate or key from the network side to achieve strong authentication. ,

 The process of performing strong authentication by using a certificate or a key through DHCP in the embodiment of the present invention is as shown in FIG. 2, and includes:

 Step 201: The user equipment (that is, the DHCP client) obtains the user name and password of the user by using a user input manner, for example, by popping up a window on the user equipment, prompting the user to input the user name and password, and of course, other alternative methods may also be adopted. .

 Step 202: The DHCP client broadcasts a DHCP Discover message, where the message carries the user identifier and the user password encrypted by the key (or certificate).

 The key (or certificate) may be obtained through the network (Web, FTP, etc.) after the user successfully accesses the network, or may be configured (or other out-of-band method) or extended authentication protocol EAP directly before the first startup. The mode is obtained from the network side, and the network side allocates a key (or a certificate) to the user and establishes a binding relationship between the key (or certificate) and the user.

 Step 203: After receiving the DHCP Discover message, the NAS caches the message, obtains the user identifier and the encrypted user password from the DHCP Discover, and sends an authentication request message to the AAA server, where the user identifier and the encrypted user password are carried.

Step 204: The AAA server receives the authentication request message, extracts the user identifier and the encrypted user password from the authentication request message, and then decrypts the encrypted user password according to the key corresponding to the user in the AAA server, and simultaneously decrypts the encrypted user password. Find users in the database Password, judge whether the decrypted user password and the found user password are the same. If they are the same, the authentication is successful, otherwise the authentication fails.

 Step 205: If the authentication is successful, the NAS forwards the cached DHCP Discover message to the DHCP server.

 Step 206: The DHCP server receives the DHCP Discover message and returns a DHCP Offer message.

 Step 207: The NAS forwards the DHCP Offer message to the DHCP client.

 Step 208: The DHCP client receives and processes the DHCP Offer message, and returns a DHCP Request message.

 Step 209: The NAS forwards the DHCP Request message to the DHCP server.

 Step 210: The DHCP server receives and processes the DHCP Request message, and returns a DHCP Ack message.

 Step 211: The NAS forwards the DHCP Ack message to the DHCP client.

 Step 212: The DHCP client receives the DHCP Ack message and successfully accesses the network.

 In this embodiment, the user can directly encrypt the user password by using a key or a certificate, and then the AAA server searches for the corresponding key or certificate to decrypt the encrypted user password, and determines the decrypted user password and the saved user password. Whether it is the same to achieve the authentication of the user. The key or the certificate can be obtained by the user after the user successfully accesses the network, or can be obtained before the authentication by using the configuration mode (or other out-of-band method) or EAP mode. This method can authenticate the user by decrypting the user password by using the key or certificate corresponding to the user in the AAA server, so that the attack of the illegal user can be effectively prevented.

The user authentication process in the above embodiments is applicable not only to DHCPv4 authentication, but also to DHCPv6 authentication. The embodiment of the invention encrypts the user password by using the random number assigned by the network side, so that the password transmission is more secure; no special client software is needed, as long as the DHCP protocol is supported; the IP address is assigned after the authentication, and the IP address is avoided. Waste; implement user authentication on the network layer; the authentication server has a binding relationship between the user and the key (or certificate). The illegal user cannot obtain the correct key (or certificate), and thus cannot pass the authentication, which can effectively prevent illegal. User's attack.

 The above specific embodiments are merely illustrative of the invention and are not intended to limit the invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

Claim  A method for user access authentication, which is characterized in that: the user is authenticated before the user accesses the network by using the IP address assigned by the dynamic host configuration protocol DHCP server, including:  The user end acquires the encrypted information from the network side, encrypts the user password by using the encrypted information, and transmits the encrypted user password to the network side;  The network side authenticates the user end according to the encrypted information and a pre-stored user password.  2. The method according to claim 1, wherein the acquiring, by the user end, the encrypted information from the network side comprises:  The UE obtains a random number from the network side.  The method according to claim 2, wherein the acquiring, by the user end, the random number from the network side includes:  The authentication server generates the random number and sends the random number to the DHCP server. The DHCP server sends the random number to the user by using a DHCP providing message.  4. The method according to claim 2, wherein the acquiring, by the user end, the random number from the network side comprises:  The network access server generates the random number, and sends the random number to the DHCP server through a DHCP discovery message;  The DHCP server sends the random number to the user through a DHCP providing message.  The method according to claim 2, wherein the acquiring, by the user end, the random number from the network side comprises: The DHCP server generates the random number and provides the message by DHCP The number is sent to the client.  The method according to claim 2, wherein the user end and the network side negotiate an encryption algorithm for encrypting a user password in an authentication process, or pre-set the encryption algorithm.  The method according to claim 6, wherein the determining, by the user end and the network side, the encryption algorithm in the authentication process comprises:  Transmitting, by the UE, the at least one encryption algorithm that it supports to the network access server; the network access server sends a request carrying the at least one encryption algorithm to the authentication server, where the authentication server is from the at least Selecting an encryption algorithm from an encryption algorithm, and returning the selected encryption algorithm to the network access server;  The network access server sends the selected encryption algorithm to a DHCP server through a DHCP discovery message;  The DHCP server sends the selected encryption algorithm to the client through a DHCP provisioning message.  The method according to claim 3, 4 or 5, wherein the user end encrypts the user password according to the encrypted information, and transmits the encrypted user password to the network side, including:  The user end encrypts the user password by using the random number, and sends the random number and the encrypted user password to the network access server by using a DHCP request message; the network access server receives the DHCP request And sending the random number and the encrypted user password in the authentication request to the authentication server.  The method according to claim 8, wherein the network side performs authentication on the user end according to the encrypted information and a pre-stored user password, including: The authentication server performs encryption operation on the pre-stored user password by using the random number, and performs the encrypted user password and the encrypted user password carried in the authentication request. For comparison, if they are consistent, the certification is passed.  The method according to claim 9, further comprising: after the user end authentication, obtaining a key or a certificate from the network side;  When re-authenticating or restarting the authentication, the user end encrypts the user password according to the key or the certificate;  The authentication server decrypts the encrypted user password according to the key or the certificate, and compares the decrypted user password with the user password pre-stored in the authentication server.  The method according to claim 1, wherein the acquiring, by the user end, the encrypted information from the network side comprises:  The client obtains a key or certificate from the network side.  12. The method of claim 11 wherein:  The client obtains the key or certificate through a network, an outband mode, or an extended authentication protocol.  The method according to claim 11, wherein the user end encrypts the user password by using the key or the certificate, and transmits the encrypted user password to the network side;  The network side authenticates the user terminal according to the encrypted information and the pre-stored user password, including:  The authentication server decrypts the encrypted user password by using the key or the certificate, and compares the decrypted user password with the user password pre-stored by the authentication server, and if so, the authentication passes.  14. A user access authentication system, comprising: The network side device is configured to send the encrypted information, and authenticate the user equipment according to the encrypted information and the pre-stored user password. After the authentication is passed, the user equipment is allocated an IP address. address;  The user equipment is configured to encrypt the user password by using the encrypted information sent by the network side device, and transmit the encrypted user password to the network side device, and use the network side after the authentication is passed. The IP address assigned by the device is connected to the network.  The system according to claim 14, wherein the encrypted information is a random number; the network side device comprises:  The authentication server generates the random number, and sends the random number to the user equipment, and authenticates the user equipment according to the random number and the pre-stored user password; the DHCP server is the user end The device assigns an IP address.  The system according to claim 14, wherein the encrypted information is a random number; the network side device comprises:  The network access server generates the random number, and sends the random number to the user equipment;  The authentication server receives the encrypted user password sent by the user equipment, and authenticates the user equipment according to the random number and the pre-stored user password;  A DHCP server allocates an IP address to the client device.  The system according to claim 14, wherein the encrypted information is a random number; the network side device comprises:  The DHCP server generates the random number, and sends the random number to the user equipment, and allocates an IP address to the user equipment;  The authentication server receives the encrypted user password sent by the user equipment, and authenticates the user equipment according to the random number and the pre-stored user password.  The system according to claim 14, wherein the user equipment and the network side device are preset with an encryption algorithm for encrypting a user password. The system according to any one of claims 15 to 17, wherein The client device is further configured to send at least one encryption algorithm that it supports to the authentication server;  The authentication server is further configured to select an encryption algorithm from the at least one encryption algorithm, and return the selected encryption algorithm to the client device.  The system according to claim 14, wherein the user equipment is further configured to acquire a key or a certificate from the network side device after the authentication is passed, and according to the re-authentication or restart authentication The key or certificate encrypts the user password;  The network side device is further configured to decrypt the encrypted user password according to the key or the certificate, and compare the decrypted user password with the pre-stored user password, if one The system according to claim 14, wherein the encrypted information is a key or a certificate; the user equipment is configured to encrypt the user password by using the key or the certificate, and transmit the encrypted user password to Network side device;  The network side device is further configured to decrypt the encrypted user password according to the key or the certificate, compare the decrypted user password with the pre-stored user password, and if yes, the authentication passes.  22. A network side device, comprising:  Encrypting the information sending module, and sending, to the user end, the encrypted information used for access authentication of the user end;  The address allocation module allocates an IP address to the client after the user end authenticates. The device according to claim 11, wherein the encryption information issuing module acquires the encrypted information from the outside or generates the encrypted information by itself.